#------------------------------------------------------------------------------
# Copyright (C)2019 Robert Cowart
#
# The contents of this file and/or repository are subject to the Robert Cowart
# Public License (the "License") and may not be used or distributed except in
# compliance with the License. You may obtain a copy of the License at:
#
# http://www.koiossian.com/public/robert_cowart_public_license.txt
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for
# the specific language governing rights and limitations under the License.
#
# The Original Source Code was developed by Robert Cowart. Portions created by
# Robert Cowart are Copyright (C)2019 Robert Cowart. All Rights Reserved.
#------------------------------------------------------------------------------

[Service]
# ElastiFlow global configuration
Environment="ELASTIFLOW_DICT_PATH={{ logstash_etc }}/elastiflow/dictionaries"
Environment="ELASTIFLOW_DEFINITION_PATH={{ logstash_etc }}/elastiflow/definitions"
Environment="ELASTIFLOW_TEMPLATE_PATH={{ logstash_etc }}/elastiflow/templates"
Environment="ELASTIFLOW_GEOIP_DB_PATH={{ logstash_etc }}/elastiflow/geoipdbs"
Environment="ELASTIFLOW_GEOIP_CACHE_SIZE=8192"
Environment="ELASTIFLOW_GEOIP_LOOKUP=true"
Environment="ELASTIFLOW_ASN_LOOKUP=true"
Environment="ELASTIFLOW_KEEP_ORIG_DATA=true"
Environment="ELASTIFLOW_DEFAULT_APPID_SRCTYPE=__UNKNOWN"


# Name resolution option
Environment="ELASTIFLOW_RESOLVE_IP2HOST=false"
Environment="ELASTIFLOW_NAMESERVER=223.5.5.5"
Environment="ELASTIFLOW_DNS_HIT_CACHE_SIZE=25000"
Environment="ELASTIFLOW_DNS_HIT_CACHE_TTL=900"
Environment="ELASTIFLOW_DNS_FAILED_CACHE_SIZE=75000"
Environment="ELASTIFLOW_DNS_FAILED_CACHE_TTL=3600"


# Elasticsearch connection settings
{% if es_username is defined %}
Environment="ELASTIFLOW_ES_USER={{ es_username }}"
Environment="ELASTIFLOW_ES_PASSWD={{ es_password }}"
{% endif %}

{% for es in es_hosts %}
{% if loop.length == 1 %}
Environment="ELASTIFLOW_ES_HOST={{ es }}"
{% elif loop.length > 1 %}
Environment="ELASTIFLOW_ES_HOST_{{ loop.index }}={{ es }}"
{% endif %}
{% endfor %}

# If ELASTIFLOW_ES_SSL_VERIFY is true then you must edit the output and set the path where the cacert can be found.
Environment="ELASTIFLOW_ES_SSL_ENABLE={{ ssl_enabled | lower }}"
Environment="ELASTIFLOW_ES_SSL_VERIFY={{ ssl_verify | lower }}"


# Netflow - IPv4
Environment="ELASTIFLOW_NETFLOW_IPV4_HOST=0.0.0.0"
Environment="ELASTIFLOW_NETFLOW_IPV4_PORT=2055"
# Netflow - IPv6
Environment="ELASTIFLOW_NETFLOW_IPV6_HOST=[::]"
Environment="ELASTIFLOW_NETFLOW_IPV6_PORT=52055"
# Netflow - UDP input options
Environment="ELASTIFLOW_NETFLOW_UDP_WORKERS=4"
Environment="ELASTIFLOW_NETFLOW_UDP_QUEUE_SIZE=4096"
Environment="ELASTIFLOW_NETFLOW_UDP_RCV_BUFF={{ ef_udp_rcv_buff.netflow }}"
# Netflow timestamp options
Environment="ELASTIFLOW_NETFLOW_LASTSW_TIMESTAMP=false"
Environment="ELASTIFLOW_NETFLOW_TZ={{ ef_netflow_tz }}"


# sFlow - IPv4
Environment="ELASTIFLOW_SFLOW_IPV4_HOST=0.0.0.0"
Environment="ELASTIFLOW_SFLOW_IPV4_PORT=6343"
# sFlow - IPv6
Environment="ELASTIFLOW_SFLOW_IPV6_HOST=[::]"
Environment="ELASTIFLOW_SFLOW_IPV6_PORT=56343"
# sFlow - UDP input options
Environment="ELASTIFLOW_SFLOW_UDP_WORKERS=4"
Environment="ELASTIFLOW_SFLOW_UDP_QUEUE_SIZE=4096"
Environment="ELASTIFLOW_SFLOW_UDP_RCV_BUFF={{ ef_udp_rcv_buff.sflow }}"


# IPFIX - IPv4
Environment="ELASTIFLOW_IPFIX_TCP_IPV4_HOST=0.0.0.0"
Environment="ELASTIFLOW_IPFIX_TCP_IPV4_PORT=4739"
Environment="ELASTIFLOW_IPFIX_UDP_IPV4_HOST=0.0.0.0"
Environment="ELASTIFLOW_IPFIX_UDP_IPV4_PORT=4739"
# IPFIX - IPv6
Environment="ELASTIFLOW_IPFIX_TCP_IPV6_HOST=[::]"
Environment="ELASTIFLOW_IPFIX_TCP_IPV6_PORT=54739"
Environment="ELASTIFLOW_IPFIX_UDP_IPV6_HOST=[::]"
Environment="ELASTIFLOW_IPFIX_UDP_IPV6_PORT=54739"
# IPFIX - UDP input options
Environment="ELASTIFLOW_IPFIX_UDP_WORKERS=4"
Environment="ELASTIFLOW_IPFIX_UDP_QUEUE_SIZE=4096"
Environment="ELASTIFLOW_IPFIX_UDP_RCV_BUFF={{ ef_udp_rcv_buff.ipfix }}"
